vendor:
Web Server
by:
SecurityFocus
7.5
CVSS
HIGH
Information Disclosure
200
CWE
Product Name: Web Server
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
Omitting the HTTP version from a ‘GET’ request for a CGI script to the Savant Web Server discloses the source code of the script
Omitting the HTTP version from a 'GET' request for a CGI script to the Savant Web Server discloses the source code of the script. An attacker can use telnet to connect to the target and issue a GET request for the CGI script without specifying the HTTP version. The source code of the script will then be displayed.
Mitigation:
Ensure that the Savant Web Server is configured to not allow the omission of the HTTP version from a 'GET' request for a CGI script.
